CVE-2026-2021 is a stored cross-site scripting vulnerability in the Slideshow Gallery LITE plugin for WordPress. It affects all versions up to and including 1.8.5. The issue is caused by improper neutralization of user-supplied input in the 'alwaysauto' shortcode attribute, enabling authenticated attackers with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users who visit the injected pages, potentially leading to information disclosure or session hijacking. No official patch or remediation level has been provided in the available data.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages using the vulnerable shortcode attribute. This can lead to execution of arbitrary scripts in the browsers of users who view the compromised pages, potentially resulting in information disclosure or user session compromise. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Slideshow Gallery LITE plugin if possible to prevent exploitation.